Threat model.
We consider the setting where the adversary is an honest-but-curious server, who executes the learning protocol faithfully but aims to extract private training data from the observed gradients. We also assume that the FL protocol does not leverage secure aggregation, so per-client gradients are revealed to the server. Under these assumptions, in each FL iteration the adversary has the knowledge of model weights \(\mathbf {w}\)  and the gradients \(\nabla _{\mathbf {w}}\ell (f_{\mathbf {w}}(\mathbf {x}), y)\)  for each sample \((\mathbf {x},y)\)  in the batch. Moreover, we assume the adversary has an auxiliary dataset \(\mathcal {D}_{\rm aux}\) , which could be in-distribution or a mixture of in-distribution and out-of-distribution data.
This assumption is similar to the setting in [1]}, which assumes a generative model that is trained from the in-distribution data, and is common in the study of other privacy attacks such as membership inference [2]}.
